Data Privacy and Cybersecurity Rules for Mobile Apps in the Philippines

1Why a mobile app is a "data processing system" under Philippine law

A mobile app that creates accounts, reads device identifiers, requests location, embeds analytics or runs push notifications is processing personal information in the sense of Republic Act No. 10173, the Data Privacy Act of 2012 (DPA), approved on 15 August 2012. The Act applies to natural and juridical persons that process personal information, and Section 6 extends it to acts done outside the Philippines where the data relates to Philippine citizens or residents and the entity has a link to the country. A studio in Singapore or Estonia that publishes an app to Filipino users through the Apple App Store or Google Play is therefore not outside the law simply because its servers are abroad.

The DPA distinguishes between the personal information controller (PIC), which decides why and how data is processed, and the personal information processor (PIP), which processes on the controller's instructions. For most consumer apps the publisher is the PIC. Cloud hosts, analytics vendors, customer-support tools and outsourced development teams are typically PIPs, although an SDK vendor that reuses data for its own advertising business is acting as a separate controller. Getting this classification right at the design stage drives everything that follows: who signs what, who registers with the National Privacy Commission (NPC), and who must notify a breach.

The NPC also treats the app itself, together with its back end, as a data processing system. NPC Circular No. 2022-04, issued on 5 December 2022 and effective 11 January 2023, expressly covers online web-based and mobile applications when it describes the systems that may have to be registered. The practical consequence is that the compliance file for an app cannot be a single privacy policy page; it is a set of decisions and records that follow the product through its life cycle.

2Lawful basis, privacy notices and consent screens

Section 12 of the DPA lists the lawful bases for processing ordinary personal information: consent, performance of a contract, compliance with a legal obligation, protection of life and health, public authority functions, and the legitimate interests of the controller or a third party. Section 13 sets a narrower list for sensitive personal information, where "specific" consent or a law that mandates the processing are the usual routes. The first design question for any feature is therefore not "where do we put the consent toggle" but "which basis actually fits". Creating an account and delivering the paid service generally rests on contract; fraud monitoring may rest on legitimate interests; behavioural advertising and third-party sharing almost always need consent.

Where consent is the basis, the NPC's Guidelines on Consent (NPC Circular No. 2023-04), adopted on 7 November 2023 with obligations in force from 27 May 2024, set the standard for the user interface. Consent must be freely given, specific, informed and evidenced by a clear affirmative act; silence, inactivity or continued use alone do not count. The guidelines endorse layered notices: a concise statement at the point of collection (for example, a just-in-time prompt before the camera or location permission dialog) with a link to the full privacy notice. Withdrawal must be as easy as giving consent, must not force the user into a different interface, and must stop the processing without undue delay unless another lawful basis applies.

On the same date the Commission adopted NPC Advisory No. 2023-01 on deceptive design patterns, aimed at controllers that rely on consent. Pre-ticked boxes, "accept" buttons that are visually dominant over "decline", repeated nagging, and guilt-tripping language ("No thanks, I don't want to protect my account") are the kind of interface choices that can invalidate consent. Product and legal teams should review onboarding flows against both issuances together.

What the privacy notice itself must do

The right to be informed in Section 16 requires the user to know, before data is entered into the system, what is collected, why, how, for how long, with whom it is shared, how automated decisions are made, and how to exercise their rights. For an app this means the notice must be reachable from the store listing, from the first-run screen and from settings, and it must match what the code actually does. App store privacy labels and data-safety forms are not a substitute for the notice, but regulators and users will compare the two, so inconsistencies between the form and the notice are an avoidable risk.

• Map every data field and permission to a Section 12 or Section 13 basis before writing copy.
• Use just-in-time prompts for camera, microphone, contacts, location and advertising identifiers.
• Keep a consent log with version, timestamp and the text shown, since consent must be evidenced.
• Make withdrawal and account deletion available in-app, not only by email.
• Re-test onboarding against the deceptive design advisory after each redesign.

3Data protection officer, NPC registration and the Seal of Registration

Section 21 of the DPA requires every controller to designate one or more individuals accountable for compliance. NPC Circular No. 2022-04 turned that into a registration regime. A PIC or PIP must register its data processing systems through the NPC Registration System (NPCRS) if it employs 250 or more persons, processes sensitive personal information of 1,000 or more individuals, or processes data that is likely to pose a risk to the rights and freedoms of data subjects. In addition, any system used for automated decision-making or profiling must be registered in all cases, and the registration must disclose the lawful basis, retention period, the methods and logic of the automated processing and the decisions it may produce.

For app developers the thresholds are easier to cross than they look. A health, fintech, dating or ride-hailing app with a few thousand verified users will usually exceed the 1,000-record sensitive-data threshold. A recommendation engine, dynamic pricing model or fraud score is profiling. Entities not subject to mandatory registration must still file a sworn declaration of exemption, and voluntary registration is open to everyone.

The Circular is explicit that a DPO should be an organic employee unless the Commission allows otherwise, which matters for lean startups that would prefer to outsource the role entirely. Common DPOs across a corporate group are allowed if each entity registers separately. For foreign publishers without a Philippine entity, the Circular still contemplates registration where a data processing system operates in the Philippines; how a non-resident company satisfies the organic-employee expectation is a question to raise with counsel rather than assume away.

4SDKs, trackers, processors and cross-border transfers

The modern app is an assembly of third-party code. Crash reporting, attribution, A/B testing, advertising mediation, authentication and payment SDKs each open a data flow that the publisher is accountable for. Section 14 of the DPA allows subcontracting but requires the controller to ensure that proper safeguards are in place and that the processor complies with the Act. Section 21 keeps the controller responsible for information that has been transferred to a third party, whether domestically or abroad. In NPC practice the usual instrument is a written outsourcing or processing agreement that fixes the purpose, the security measures, sub-processing, breach reporting timelines and deletion on termination.

Where two controllers share data, for example an app publisher and a bank partner, or a game studio and an advertising network that uses the data for its own purposes, the NPC speaks of a data sharing agreement. In NPC Advisory No. 2025-01 of 26 June 2025 the Commission clarified NPC Circular No. 2020-03: a data sharing agreement is strongly encouraged but not legally required, does not need NPC approval, and does not by itself make sharing lawful. What is required is a valid legal basis under Section 12 or 13 and documentation of it. The absence of an agreement is not a violation; sharing without a basis is.

Cross-border transfers are common because most analytics and hosting vendors are offshore. The DPA has no adequacy or localisation mechanism; it works through accountability. To help controllers discharge that duty the NPC published NPC Advisory No. 2024-01 on model contractual clauses for cross-border transfers, dated 30 May 2024. The clauses are for voluntary adoption, the Commission does not review agreements for conformity, and it pointed controllers to the ASEAN and EU model clause frameworks as reference material. Sector rules may add localisation or outsourcing approvals, notably for entities supervised by the Bangko Sentral ng Pilipinas.

Practical steps for the SDK inventory

1. Build and maintain a list of every third-party library that touches personal data, with its vendor, purpose, data fields, destination country and contract reference.
2. Classify each vendor as PIP or independent controller based on what it actually does with the data, not on how it labels itself.
3. Match each flow to a lawful basis and to a line in the privacy notice; remove libraries you cannot explain.
4. Confirm contractual breach-reporting timelines are short enough for you to meet your own 72-hour duty.
5. Verify that advertising identifiers and precise location are not transmitted before the user has acted on the relevant prompt.

5Security measures, retention and breach readiness

Section 20 of the DPA requires reasonable and appropriate organisational, physical and technical measures against accidental or unlawful destruction, alteration, disclosure and other unlawful processing. The NPC gave that duty a detailed shape in NPC Circular No. 2023-06 on the Security of Personal Data in the Government and Private Sector, published on 15 March 2024 and effective on 30 March 2024. It replaced the 2016 circular that had applied only to government agencies, extends the baseline to the private sector, and adds privacy by design, privacy by default and business continuity to the expected control set. The Commission's own FAQ notes that a username, a password and an approver may not be enough to satisfy the access-control rules for online systems, and that the Commission may ask for policies and contracts when a complaint or breach triggers an audit.

The NPC followed with NPC Advisory No. 2025-02, Guidelines on Privacy Engineering in Systems Life Cycle Processes, which reads like a specification for a secure development life cycle: a privacy impact assessment in the planning phase, data minimisation and pseudonymisation in design, threat modelling and static, dynamic and fuzz testing before release, privacy-protective defaults such as location tracking off at deployment, and annual audits and PIAs in operation. Although framed as an advisory, it describes how the Commission expects the statutory duties to be met, and it is a useful checklist to hand to an engineering lead.

Retention

Proportionality under the DPA and its Implementing Rules means personal data is retained only for as long as necessary for the declared purpose, or as a law requires. For apps this translates into a retention schedule by data category: account data for the life of the account plus a defined grace period, transaction records for the periods that tax, anti-money-laundering or consumer rules demand, analytics in pseudonymised form with a fixed horizon, and crash logs scrubbed of identifiers. Deletion on account closure should cascade to processors under the contract terms discussed above.

Breach notification in brief

Under Section 20(f) of the DPA and the NPC's breach management circular (NPC Circular No. 16-03), the Commission and affected data subjects must be notified within 72 hours of knowledge or reasonable belief of a breach where sensitive personal information, or data that could enable identity fraud, is reasonably believed to have been acquired by an unauthorised person and the acquisition is likely to pose a real risk of serious harm. Incidents that fall short of that test are still documented and summarised in an annual security incident report, and notifications are filed through the NPC's online Data Breach Notification Management System. We have covered the mechanics, the DPO's checklist and the common mistakes in our separate guide to Data Privacy Act breach notification, so this article does not repeat them; the point for developers is that the 72-hour clock only works if logging, alerting and vendor reporting duties were designed in beforehand.

• 72 hours
  Deadline to notify the NPC and affected data subjects of a notifiable personal data breach
• 30 March 2024
  NPC Circular 2023-06 security baseline took effect for the private sector
• 20 days
  Window to register a new data processing system or a newly appointed DPO under Circular 2022-04
• 1 year
  Validity of the NPC Certificate and Seal of Registration before renewal

6Children and other vulnerable users

Any app that is directed at, or likely to be accessed by, users under 18 attracts additional expectations. The NPC's Advisory on Guidelines on Child-Oriented Transparency, dated 4 March 2024, defines a child as a person under 18 or an adult who cannot fully protect themselves because of a disability or condition, and applies regardless of the lawful basis relied on. Its core demands are a child-friendly privacy notice (a single notice for adults and children is not sufficient), a child privacy impact assessment before launch and when features change, age-assurance proportionate to risk (self-declaration is not banned but may be inadequate for high-risk processing), and breach notifications that reach both the child and the parent or guardian in language the child can understand. The Commission's FAQ is careful to say that the advisory does not make parental consent mandatory and that an age of digital consent would require legislation.

The regulatory temperature rose in 2026. On 23 September 2026 the NPC issued a public advisory calling on social media companies, online platforms and game developers to adopt effective, privacy-preserving age-assurance mechanisms and to stop behavioural profiling that pushes violent or unsafe content to child users, citing reports that linked unrestricted access to online content with a series of school shootings between June and September 2026. The statement invoked the DPA, its Implementing Rules and the NPC's issuances on privacy by design, automated processing and children's data, and warned that non-compliance could lead to compliance orders, cease-and-desist orders, administrative sanctions and prosecution under Sections 25 to 33 of the Act. A public advisory is not a new rule, but it signals enforcement priorities, and game and social app developers should expect questions about recommender systems and age gates.

7Cybercrime law, SIM registration and the proposed cybersecurity statute

Privacy compliance sits alongside a second body of law that treats the app and its servers as a potential crime scene. Republic Act No. 10175, the Cybercrime Prevention Act of 2012, approved on 12 September 2012, criminalises illegal access, illegal interception, data and system interference, misuse of devices, computer-related forgery, fraud and identity theft. For a developer this cuts two ways. A weak API that lets one user read another's records can turn a vulnerability into an identity-theft incident with criminal dimensions for the attacker and a breach-notification duty for the publisher. At the same time, Section 13 of the Act requires service providers to preserve traffic data and subscriber information for at least six months, and content data for six months from a preservation order, with one extension permitted; Section 20 penalises non-compliance with lawful orders. Logging architecture and retention schedules must therefore satisfy both the proportionality principle of the DPA and the preservation duties of RA 10175. Our overview of the Cybercrime Prevention Act explains the offences and procedure in more detail.

Republic Act No. 11934, the SIM Registration Act, approved on 10 October 2022, is often overlooked by app teams, yet it changes assumptions about phone numbers. Every SIM, including eSIMs, must be registered against a government ID; registration data is confidential and may be released by a telco only under the Act's narrow exceptions, generally a subpoena or court order; telcos must deactivate SIMs on reported loss or death within 24 hours and retain data for ten years; and spoofing a registered number is a criminal offence. For developers the lesson is that a phone number is neither a stable identifier nor a verified identity: numbers are recycled, and the registration database is not available to third parties for identity checks. Apps that rely on SMS one-time passwords should pair them with device binding or other factors. The liability dynamics when a number is hijacked are discussed in our article on SIM swap fraud and shared liability.

The cybersecurity bill as of the research date

There is still no general cybersecurity statute. The Senate's proposed Cybersecurity Act (Senate Bill No. 1365 in the 19th Congress) was among the bills President Marcos said he would work to pass after meeting the Private Sector Advisory Council on 28 November 2023, but it did not become law in that Congress. In the 20th Congress the House consolidated 28 bills into House Bill No. 9605, the National Cybersecurity and Critical Information Infrastructure Protection Act of 2026, which passed on third reading on 12 August 2026 and was transmitted to the Senate. The bill would create a National Cybersecurity Agency under the Office of the President, absorb the cybersecurity functions of the Department of Information and Communications Technology, and set minimum standards for public and private operators of critical information infrastructure, while expressly barring the agency from monitoring public opinion or regulating online content. As of 29 October 2026 the measure was pending in the Senate; its status, and whether the final text imposes incident-reporting or certification duties on app operators that serve critical sectors such as finance, health or transport, should be confirmed before relying on it.

1. 2012-08-15
   RA 10173 approved. Data Privacy Act enacted; NPC created.
2. 2012-09-12
   RA 10175 approved. Cybercrime Prevention Act, including data preservation duties for service providers.
3. 2022-10-10
   RA 11934 approved. SIM Registration Act.
4. 2023-01-11
   NPC Circular 2022-04 takes effect. Registration of data processing systems and DPOs, including mobile applications.
5. 2024-03-30
   NPC Circular 2023-06 takes effect. Security baseline extended to the private sector.
6. 2024-05-27
   Consent Guidelines obligations in force. NPC Circular 2023-04.
7. 2026-08-12
   House passes HB 9605. National Cybersecurity and CII Protection Act of 2026 transmitted to the Senate.
8. 2026-09-23
   NPC public advisory on children. Platforms and game developers urged to adopt age assurance and stop harmful profiling.

8A life-cycle compliance plan and key takeaways

Pulling the threads together, the obligations fall into a sequence that mirrors how an app is actually built and run. Before a line of code is written, decide who the controller is, inventory the data and permissions, assign a lawful basis to each flow and run a privacy impact assessment, adding a child privacy impact assessment where minors are plausible users. During development, apply the Circular 2023-06 controls and the privacy engineering advisory, keep third-party code to what you can justify, and draft the processing and data sharing agreements in parallel with integration work. Before launch, publish a layered notice that matches the build, test consent and withdrawal flows against the consent and deceptive-design guidance, designate and register the DPO, and register the system within 20 days if a threshold or any profiling applies. After launch, log consents, honour rights requests in-app, rehearse the 72-hour breach procedure with your vendors, renew the NPC registration inside the 30-day window, and revisit the assessment whenever a feature, SDK or market changes.

None of this requires a large legal department, but it does require that privacy decisions are recorded rather than improvised. The NPC's enforcement toolkit under the DPA ranges from compliance orders and processing bans to criminal referral, with imprisonment of one to six years and fines of up to PHP 5 million for the most serious combinations of offences, and the Commission has shown through its 2024 security circular and its 2026 statements on children's data that it expects the private sector, including app publishers, to be able to show its work.

• The DPA reaches foreign publishers whose apps serve Philippine users; server location is not a defence.
• Choose the correct lawful basis per feature; where consent is used, it must meet the 2023 consent and deceptive-design guidance.
• Any profiling or automated decision-making system must be registered with the NPC regardless of size; the 20-day and 30-day windows are strict.
• Every SDK is a data flow you are accountable for; document the vendor, the basis and the contract, and keep offshore transfers covered by contractual clauses.
• Circular 2023-06 and the privacy engineering advisory define the expected security baseline; design the 72-hour breach process before you need it.
• Children's data, SIM-based identity and the pending cybersecurity statute are the areas most likely to change in the next twelve months.

If you are planning a launch in the Philippine market, reviewing an existing app against the 2024 security baseline, or responding to an NPC inquiry, our team advises on data privacy, cybercrime and data security matters and the corporate and contractual arrangements that sit behind them, including processor agreements, data sharing agreements and NPC registration. You can contact Abanto Law Firm to arrange an initial assessment of your app's compliance position.

9Frequently asked questions